CVE-2026-15564: Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and depending on the potential gadget chains available in the running classpath.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to access the IIOP port and send malicious serialized objects. Exploitation also depends on the target EJB accepting untyped method parameters and on usable gadget chains being present in the running classpath.
Who is most exposed?
Deployments that expose an IIOP listener to attackers and host EJB methods with untyped parameters are the relevant exposure scenario. The impact is higher where the application classpath contains gadget chains that can be used during deserialization.
How can I assess whether a deployment may be affected?
Identify whether an IIOP listener is reachable by untrusted parties, then review exposed EJB interfaces for untyped method parameters. Also assess the running classpath for potential deserialization gadget chains, since their availability affects exploitability.